Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 09:08
Behavioral task
behavioral1
Sample
Trojan-Dropper.Win32.Dinwod.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
Trojan-Dropper.Win32.Dinwod.exe
-
Size
93KB
-
MD5
1bf74ede0d65257497fc8496bd27ca66
-
SHA1
93bedc93232606e3a6a2bf1f564118bf84f3f2d5
-
SHA256
a85ddf6e5526531c8b99b4bce0dff6e7194a54ab820968e41108b30e3d9a9224
-
SHA512
476d4fdfc2dd059f488303bb57250fe3b9e37b47009442c11bc8f2ebf32982ae1c580c51336fa23d33149b27f7fddf74dcb30a0cd78c3dbca2d59e7d847e5597
-
SSDEEP
1536:YvQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5R88UFuTgA:YhOmTsF93UYfwC6GIout0fmCiiiXAeF0
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2104-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/924-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/744-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/464-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1604-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-250-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/376-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-276-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1292-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-330-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2540-336-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1576-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-348-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2612-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-414-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2384-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-562-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2792-568-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2276-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-651-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2528-662-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2104-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2104-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000012247-9.dat UPX behavioral1/memory/2104-3-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/files/0x000c00000001445e-17.dat UPX behavioral1/memory/2588-35-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x002e000000014698-24.dat UPX behavioral1/files/0x0007000000014b6d-40.dat UPX behavioral1/memory/2524-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2908-23-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014aec-33.dat UPX behavioral1/memory/2660-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015c3c-56.dat UPX behavioral1/memory/2432-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2208-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2408-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c1a-64.dat UPX behavioral1/files/0x0007000000014c67-49.dat UPX behavioral1/files/0x0006000000016c23-71.dat UPX behavioral1/files/0x0006000000016c90-80.dat UPX behavioral1/memory/340-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/340-86-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016ca9-88.dat UPX behavioral1/files/0x0006000000016ccf-96.dat UPX behavioral1/memory/924-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016cd4-106.dat UPX behavioral1/memory/744-104-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/464-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d01-122.dat UPX behavioral1/files/0x0006000000016cf0-115.dat UPX behavioral1/files/0x000e000000014738-131.dat UPX behavioral1/memory/2676-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1956-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d11-138.dat UPX behavioral1/memory/1876-145-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/files/0x0006000000016d24-146.dat UPX behavioral1/files/0x0006000000016d36-153.dat UPX behavioral1/files/0x0006000000016d41-162.dat UPX behavioral1/memory/2716-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2216-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d4a-170.dat UPX behavioral1/files/0x0006000000016d4f-179.dat UPX behavioral1/memory/2200-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d55-187.dat UPX behavioral1/memory/1604-182-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d84-196.dat UPX behavioral1/memory/3048-194-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d89-203.dat UPX behavioral1/memory/2312-199-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016e56-210.dat UPX behavioral1/memory/2976-211-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000600000001704f-219.dat UPX behavioral1/files/0x0006000000017090-228.dat UPX behavioral1/memory/2128-227-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2144-229-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000500000001868c-235.dat UPX behavioral1/files/0x0005000000018698-244.dat UPX behavioral1/memory/1748-243-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1748-250-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/files/0x00050000000186a0-252.dat UPX behavioral1/files/0x0006000000018ae2-259.dat UPX behavioral1/memory/376-270-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1292-279-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/928-288-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2208 pxdbbl.exe 2908 lrppr.exe 2660 vnpndnd.exe 2588 fhnbh.exe 2524 fnlfj.exe 2432 tfjpfdl.exe 2408 bntnh.exe 2484 ljrnxdh.exe 3012 hlptj.exe 340 vjjvllr.exe 924 tflbb.exe 744 hpfdjr.exe 464 pbfnrrn.exe 1676 bptvpxn.exe 2676 xjrlnt.exe 1956 bbfrpl.exe 1876 plxrphr.exe 1948 vjjnb.exe 2216 fbnnhb.exe 2716 rfltlj.exe 2200 dnhlffr.exe 1604 jpfptpp.exe 3048 bvbnvh.exe 2312 lpbtfx.exe 2784 rtfvr.exe 2976 dlbxhbp.exe 2128 nbvfl.exe 2144 ldxxvv.exe 1684 frvnxf.exe 1748 pjhhf.exe 1792 blxhjj.exe 1632 xbxvh.exe 376 jbrbnpl.exe 1752 jjrpf.exe 1292 tnnfdpx.exe 2252 rvvvhtn.exe 928 trbdnld.exe 1028 lfrtv.exe 864 bvtvvbr.exe 2032 jhpnvd.exe 2596 txrpp.exe 2892 vtfbb.exe 2688 bjnlbr.exe 2632 tfnlr.exe 2540 djrrvfn.exe 1576 jvhhfbh.exe 1664 rtbvxrt.exe 2720 ldjtfp.exe 2612 lrjfpl.exe 2424 nbpntn.exe 2520 pnpvlb.exe 2480 fdlvh.exe 2664 lnbnnl.exe 3024 nlvtrdj.exe 2324 dvvhp.exe 680 rrpfrj.exe 1548 pbdlhx.exe 1096 rvdnlvt.exe 1756 fvvrbvj.exe 1676 fbhxx.exe 1728 vbnpb.exe 2584 plxjnr.exe 2384 djdrj.exe 932 rdntjrd.exe -
resource yara_rule behavioral1/memory/2104-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2104-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000012247-9.dat upx behavioral1/memory/2104-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000c00000001445e-17.dat upx behavioral1/memory/2588-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002e000000014698-24.dat upx behavioral1/files/0x0007000000014b6d-40.dat upx behavioral1/memory/2524-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014aec-33.dat upx behavioral1/memory/2660-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015c3c-56.dat upx behavioral1/memory/2432-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2208-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c1a-64.dat upx behavioral1/files/0x0007000000014c67-49.dat upx behavioral1/files/0x0006000000016c23-71.dat upx behavioral1/files/0x0006000000016c90-80.dat upx behavioral1/memory/340-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/340-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ca9-88.dat upx behavioral1/files/0x0006000000016ccf-96.dat upx behavioral1/memory/924-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cd4-106.dat upx behavioral1/memory/744-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/464-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d01-122.dat upx behavioral1/files/0x0006000000016cf0-115.dat upx behavioral1/files/0x000e000000014738-131.dat upx behavioral1/memory/2676-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1956-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d11-138.dat upx behavioral1/memory/1876-145-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016d24-146.dat upx behavioral1/files/0x0006000000016d36-153.dat upx behavioral1/files/0x0006000000016d41-162.dat upx behavioral1/memory/2716-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2216-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4a-170.dat upx behavioral1/files/0x0006000000016d4f-179.dat upx behavioral1/memory/2200-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d55-187.dat upx behavioral1/memory/1604-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d84-196.dat upx behavioral1/memory/3048-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d89-203.dat upx behavioral1/memory/2312-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016e56-210.dat upx behavioral1/memory/2976-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001704f-219.dat upx behavioral1/files/0x0006000000017090-228.dat upx behavioral1/memory/2128-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2144-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001868c-235.dat upx behavioral1/files/0x0005000000018698-244.dat upx behavioral1/memory/1748-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1748-250-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000186a0-252.dat upx behavioral1/files/0x0006000000018ae2-259.dat upx behavioral1/memory/376-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1292-279-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2208 2104 Trojan-Dropper.Win32.Dinwod.exe 28 PID 2104 wrote to memory of 2208 2104 Trojan-Dropper.Win32.Dinwod.exe 28 PID 2104 wrote to memory of 2208 2104 Trojan-Dropper.Win32.Dinwod.exe 28 PID 2104 wrote to memory of 2208 2104 Trojan-Dropper.Win32.Dinwod.exe 28 PID 2208 wrote to memory of 2908 2208 pxdbbl.exe 29 PID 2208 wrote to memory of 2908 2208 pxdbbl.exe 29 PID 2208 wrote to memory of 2908 2208 pxdbbl.exe 29 PID 2208 wrote to memory of 2908 2208 pxdbbl.exe 29 PID 2908 wrote to memory of 2660 2908 lrppr.exe 30 PID 2908 wrote to memory of 2660 2908 lrppr.exe 30 PID 2908 wrote to memory of 2660 2908 lrppr.exe 30 PID 2908 wrote to memory of 2660 2908 lrppr.exe 30 PID 2660 wrote to memory of 2588 2660 vnpndnd.exe 35 PID 2660 wrote to memory of 2588 2660 vnpndnd.exe 35 PID 2660 wrote to memory of 2588 2660 vnpndnd.exe 35 PID 2660 wrote to memory of 2588 2660 vnpndnd.exe 35 PID 2588 wrote to memory of 2524 2588 fhnbh.exe 34 PID 2588 wrote to memory of 2524 2588 fhnbh.exe 34 PID 2588 wrote to memory of 2524 2588 fhnbh.exe 34 PID 2588 wrote to memory of 2524 2588 fhnbh.exe 34 PID 2524 wrote to memory of 2432 2524 fnlfj.exe 31 PID 2524 wrote to memory of 2432 2524 fnlfj.exe 31 PID 2524 wrote to memory of 2432 2524 fnlfj.exe 31 PID 2524 wrote to memory of 2432 2524 fnlfj.exe 31 PID 2432 wrote to memory of 2408 2432 tfjpfdl.exe 32 PID 2432 wrote to memory of 2408 2432 tfjpfdl.exe 32 PID 2432 wrote to memory of 2408 2432 tfjpfdl.exe 32 PID 2432 wrote to memory of 2408 2432 tfjpfdl.exe 32 PID 2408 wrote to memory of 2484 2408 bntnh.exe 33 PID 2408 wrote to memory of 2484 2408 bntnh.exe 33 PID 2408 wrote to memory of 2484 2408 bntnh.exe 33 PID 2408 wrote to memory of 2484 2408 bntnh.exe 33 PID 2484 wrote to memory of 3012 2484 ljrnxdh.exe 36 PID 2484 wrote to memory of 3012 2484 ljrnxdh.exe 36 PID 2484 wrote to memory of 3012 2484 ljrnxdh.exe 36 PID 2484 wrote to memory of 3012 2484 ljrnxdh.exe 36 PID 3012 wrote to memory of 340 3012 hlptj.exe 37 PID 3012 wrote to memory of 340 3012 hlptj.exe 37 PID 3012 wrote to memory of 340 3012 hlptj.exe 37 PID 3012 wrote to memory of 340 3012 hlptj.exe 37 PID 340 wrote to memory of 924 340 vjjvllr.exe 38 PID 340 wrote to memory of 924 340 vjjvllr.exe 38 PID 340 wrote to memory of 924 340 vjjvllr.exe 38 PID 340 wrote to memory of 924 340 vjjvllr.exe 38 PID 924 wrote to memory of 744 924 tflbb.exe 39 PID 924 wrote to memory of 744 924 tflbb.exe 39 PID 924 wrote to memory of 744 924 tflbb.exe 39 PID 924 wrote to memory of 744 924 tflbb.exe 39 PID 744 wrote to memory of 464 744 hpfdjr.exe 40 PID 744 wrote to memory of 464 744 hpfdjr.exe 40 PID 744 wrote to memory of 464 744 hpfdjr.exe 40 PID 744 wrote to memory of 464 744 hpfdjr.exe 40 PID 464 wrote to memory of 1676 464 pbfnrrn.exe 41 PID 464 wrote to memory of 1676 464 pbfnrrn.exe 41 PID 464 wrote to memory of 1676 464 pbfnrrn.exe 41 PID 464 wrote to memory of 1676 464 pbfnrrn.exe 41 PID 1676 wrote to memory of 2676 1676 bptvpxn.exe 42 PID 1676 wrote to memory of 2676 1676 bptvpxn.exe 42 PID 1676 wrote to memory of 2676 1676 bptvpxn.exe 42 PID 1676 wrote to memory of 2676 1676 bptvpxn.exe 42 PID 2676 wrote to memory of 1956 2676 xjrlnt.exe 43 PID 2676 wrote to memory of 1956 2676 xjrlnt.exe 43 PID 2676 wrote to memory of 1956 2676 xjrlnt.exe 43 PID 2676 wrote to memory of 1956 2676 xjrlnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan-Dropper.Win32.Dinwod.exe"C:\Users\Admin\AppData\Local\Temp\Trojan-Dropper.Win32.Dinwod.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pxdbbl.exec:\pxdbbl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\lrppr.exec:\lrppr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vnpndnd.exec:\vnpndnd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\fhnbh.exec:\fhnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588
-
-
-
-
-
\??\c:\tfjpfdl.exec:\tfjpfdl.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\bntnh.exec:\bntnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\ljrnxdh.exec:\ljrnxdh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\hlptj.exec:\hlptj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vjjvllr.exec:\vjjvllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\tflbb.exec:\tflbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\hpfdjr.exec:\hpfdjr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\pbfnrrn.exec:\pbfnrrn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\bptvpxn.exec:\bptvpxn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\xjrlnt.exec:\xjrlnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bbfrpl.exec:\bbfrpl.exe11⤵
- Executes dropped EXE
PID:1956 -
\??\c:\plxrphr.exec:\plxrphr.exe12⤵
- Executes dropped EXE
PID:1876 -
\??\c:\vjjnb.exec:\vjjnb.exe13⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fbnnhb.exec:\fbnnhb.exe14⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rfltlj.exec:\rfltlj.exe15⤵
- Executes dropped EXE
PID:2716 -
\??\c:\dnhlffr.exec:\dnhlffr.exe16⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jpfptpp.exec:\jpfptpp.exe17⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bvbnvh.exec:\bvbnvh.exe18⤵
- Executes dropped EXE
PID:3048 -
\??\c:\lpbtfx.exec:\lpbtfx.exe19⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rtfvr.exec:\rtfvr.exe20⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dlbxhbp.exec:\dlbxhbp.exe21⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nbvfl.exec:\nbvfl.exe22⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ldxxvv.exec:\ldxxvv.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\frvnxf.exec:\frvnxf.exe24⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pjhhf.exec:\pjhhf.exe25⤵
- Executes dropped EXE
PID:1748 -
\??\c:\blxhjj.exec:\blxhjj.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xbxvh.exec:\xbxvh.exe27⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jbrbnpl.exec:\jbrbnpl.exe28⤵
- Executes dropped EXE
PID:376 -
\??\c:\jjrpf.exec:\jjrpf.exe29⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tnnfdpx.exec:\tnnfdpx.exe30⤵
- Executes dropped EXE
PID:1292 -
\??\c:\rvvvhtn.exec:\rvvvhtn.exe31⤵
- Executes dropped EXE
PID:2252 -
\??\c:\trbdnld.exec:\trbdnld.exe32⤵
- Executes dropped EXE
PID:928 -
\??\c:\lfrtv.exec:\lfrtv.exe33⤵
- Executes dropped EXE
PID:1028 -
\??\c:\bvtvvbr.exec:\bvtvvbr.exe34⤵
- Executes dropped EXE
PID:864 -
\??\c:\jhpnvd.exec:\jhpnvd.exe35⤵
- Executes dropped EXE
PID:2032 -
\??\c:\txrpp.exec:\txrpp.exe36⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vtfbb.exec:\vtfbb.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bjnlbr.exec:\bjnlbr.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tfnlr.exec:\tfnlr.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\djrrvfn.exec:\djrrvfn.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jvhhfbh.exec:\jvhhfbh.exe41⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rtbvxrt.exec:\rtbvxrt.exe42⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ldjtfp.exec:\ldjtfp.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lrjfpl.exec:\lrjfpl.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nbpntn.exec:\nbpntn.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pnpvlb.exec:\pnpvlb.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fdlvh.exec:\fdlvh.exe47⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lnbnnl.exec:\lnbnnl.exe48⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nlvtrdj.exec:\nlvtrdj.exe49⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dvvhp.exec:\dvvhp.exe50⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rrpfrj.exec:\rrpfrj.exe51⤵
- Executes dropped EXE
PID:680 -
\??\c:\pbdlhx.exec:\pbdlhx.exe52⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rvdnlvt.exec:\rvdnlvt.exe53⤵
- Executes dropped EXE
PID:1096 -
\??\c:\fvvrbvj.exec:\fvvrbvj.exe54⤵
- Executes dropped EXE
PID:1756 -
\??\c:\fbhxx.exec:\fbhxx.exe55⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vbnpb.exec:\vbnpb.exe56⤵
- Executes dropped EXE
PID:1728 -
\??\c:\plxjnr.exec:\plxjnr.exe57⤵
- Executes dropped EXE
PID:2584 -
\??\c:\djdrj.exec:\djdrj.exe58⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rdntjrd.exec:\rdntjrd.exe59⤵
- Executes dropped EXE
PID:932 -
\??\c:\lnlbtjr.exec:\lnlbtjr.exe60⤵PID:2000
-
\??\c:\dnftdnn.exec:\dnftdnn.exe61⤵PID:2356
-
\??\c:\nprvjnv.exec:\nprvjnv.exe62⤵PID:2328
-
\??\c:\bttlf.exec:\bttlf.exe63⤵PID:2216
-
\??\c:\xbjdp.exec:\xbjdp.exe64⤵PID:1972
-
\??\c:\xdfprnj.exec:\xdfprnj.exe65⤵PID:784
-
\??\c:\hfdrn.exec:\hfdrn.exe66⤵PID:2200
-
\??\c:\xntfftj.exec:\xntfftj.exe67⤵PID:1432
-
\??\c:\drjttr.exec:\drjttr.exe68⤵PID:1764
-
\??\c:\xjddl.exec:\xjddl.exe69⤵PID:3044
-
\??\c:\xbnvnhj.exec:\xbnvnhj.exe70⤵PID:2036
-
\??\c:\tbxxh.exec:\tbxxh.exe71⤵PID:2984
-
\??\c:\bnxjp.exec:\bnxjp.exe72⤵PID:3000
-
\??\c:\phjhf.exec:\phjhf.exe73⤵PID:2052
-
\??\c:\bhphnxd.exec:\bhphnxd.exe74⤵PID:440
-
\??\c:\txthxd.exec:\txthxd.exe75⤵PID:2128
-
\??\c:\hhfnn.exec:\hhfnn.exe76⤵PID:1056
-
\??\c:\rxtpj.exec:\rxtpj.exe77⤵PID:1524
-
\??\c:\hfnfll.exec:\hfnfll.exe78⤵PID:2964
-
\??\c:\lbvjl.exec:\lbvjl.exe79⤵PID:1872
-
\??\c:\vhnpdp.exec:\vhnpdp.exe80⤵PID:1348
-
\??\c:\pfdhfb.exec:\pfdhfb.exe81⤵PID:1632
-
\??\c:\jllhb.exec:\jllhb.exe82⤵PID:2748
-
\??\c:\hhhhprl.exec:\hhhhprl.exe83⤵PID:1752
-
\??\c:\ffrfl.exec:\ffrfl.exe84⤵PID:2792
-
\??\c:\ddxhd.exec:\ddxhd.exe85⤵PID:1240
-
\??\c:\vpxjpj.exec:\vpxjpj.exe86⤵PID:2276
-
\??\c:\xhjjnr.exec:\xhjjnr.exe87⤵PID:2292
-
\??\c:\btftp.exec:\btftp.exe88⤵PID:1148
-
\??\c:\xthrp.exec:\xthrp.exe89⤵PID:2736
-
\??\c:\bvxjvt.exec:\bvxjvt.exe90⤵PID:2208
-
\??\c:\ljfplt.exec:\ljfplt.exe91⤵PID:2700
-
\??\c:\dprpvd.exec:\dprpvd.exe92⤵PID:2888
-
\??\c:\dpdvlpx.exec:\dpdvlpx.exe93⤵PID:2632
-
\??\c:\hbnvdnb.exec:\hbnvdnb.exe94⤵PID:1564
-
\??\c:\vplnbx.exec:\vplnbx.exe95⤵PID:2560
-
\??\c:\hpndvhh.exec:\hpndvhh.exe96⤵PID:2580
-
\??\c:\tnvbrh.exec:\tnvbrh.exe97⤵PID:2408
-
\??\c:\pflxjf.exec:\pflxjf.exe98⤵PID:2600
-
\??\c:\hltfbtn.exec:\hltfbtn.exe99⤵PID:2712
-
\??\c:\dvxbv.exec:\dvxbv.exe100⤵PID:2692
-
\??\c:\nfhvlj.exec:\nfhvlj.exe101⤵PID:2528
-
\??\c:\xnfnxbp.exec:\xnfnxbp.exe102⤵PID:2840
-
\??\c:\rtdpx.exec:\rtdpx.exe103⤵PID:760
-
\??\c:\txdxbb.exec:\txdxbb.exe104⤵PID:2392
-
\??\c:\nhljn.exec:\nhljn.exe105⤵PID:2360
-
\??\c:\rdvhlxh.exec:\rdvhlxh.exe106⤵PID:2080
-
\??\c:\xpjnbl.exec:\xpjnbl.exe107⤵PID:680
-
\??\c:\rxxrr.exec:\rxxrr.exe108⤵PID:1616
-
\??\c:\tvddbr.exec:\tvddbr.exe109⤵PID:1096
-
\??\c:\nbpvr.exec:\nbpvr.exe110⤵PID:564
-
\??\c:\tnjdp.exec:\tnjdp.exe111⤵PID:2668
-
\??\c:\hxdjj.exec:\hxdjj.exe112⤵PID:1824
-
\??\c:\jvjpjnx.exec:\jvjpjnx.exe113⤵PID:1008
-
\??\c:\hdrvx.exec:\hdrvx.exe114⤵PID:748
-
\??\c:\pjdjrhx.exec:\pjdjrhx.exe115⤵PID:1876
-
\??\c:\jtjth.exec:\jtjth.exe116⤵PID:2028
-
\??\c:\lhrhr.exec:\lhrhr.exe117⤵PID:1948
-
\??\c:\txfht.exec:\txfht.exe118⤵PID:2232
-
\??\c:\rlvblll.exec:\rlvblll.exe119⤵PID:1388
-
\??\c:\hjhrbl.exec:\hjhrbl.exe120⤵PID:2316
-
\??\c:\thvtjn.exec:\thvtjn.exe121⤵PID:1392
-
\??\c:\nffhp.exec:\nffhp.exe122⤵PID:1916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-